> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/html-injection.md).

# HTML Injection

HTML Injection is a vulnerability that occurs when an application includes user-controlled input in a webpage without properly encoding or sanitizing it. As a result, an attacker can inject HTML elements that are interpreted and rendered by the victim's browser.

Unlike Cross-Site Scripting (XSS), HTML Injection does not necessarily involve JavaScript execution. Instead, the attacker manipulates the structure or appearance of a webpage by injecting HTML tags.

This vulnerability is commonly found in comment sections, profile pages, search results, feedback forms, and other areas where user input is displayed back to users.

***

### How to Exploit

1. Identify an input field that accepts user-controlled data.
2. Confirm that the submitted content is reflected somewhere in the application's response.
3. Submit HTML content instead of normal text.
4. Observe whether the browser renders the HTML elements rather than displaying them as plain text.
5. If the HTML is rendered, the attacker can modify how the page appears to other users.
6. Depending on the application's functionality, injected HTML may be stored in the database and displayed whenever other users visit the affected page.
7. The attacker can use injected HTML to alter content, display misleading information, create fake forms, or manipulate the user interface.

***

### Impact

* **Content injection:** Insert arbitrary HTML into web pages viewed by users.
* **Website defacement:** Modify the appearance or layout of the application.
* **Phishing attacks:** Display fake login forms or misleading content to steal user credentials.

***

### Prevention

* **Encode HTML output:** Escape untrusted input before rendering it in HTML.
* **Sanitise user input:** Remove or allow only safe HTML elements and attributes.
* **Use allowlists:** Permit only approved HTML tags and attributes when HTML input is required.
* **Implement Content Security Policy (CSP):** Reduce the impact of injected content and scripts.